[kernel/f16] CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923)
Josh Boyer
jwboyer at fedoraproject.org
Wed Oct 31 18:02:56 UTC 2012
commit 81f7c502c415cf9c491b42f07bb8094ab6472244
Author: Josh Boyer <jwboyer at redhat.com>
Date: Wed Oct 31 13:58:56 2012 -0400
CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923)
kernel.spec | 9 ++
...-divide-by-zero-in-tcp-algorithm-illinois.patch | 117 ++++++++++++++++++++
2 files changed, 126 insertions(+), 0 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index f4b5ce6..1055b51 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -707,6 +707,9 @@ Patch22089: 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch
Patch22090: 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch
Patch22091: 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
+#rhbz 871923 871848 CVE-2012-4565
+Patch22092: net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
+
# Debug patches
Patch30000: weird-root-dentry-name-debug.patch
Patch30010: debug-808990.patch
@@ -1339,6 +1342,9 @@ ApplyPatch 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch
ApplyPatch 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch
ApplyPatch 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
+#rhbz 871923 871848 CVE-2012-4565
+ApplyPatch net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2039,6 +2045,9 @@ fi
# and build.
%changelog
+* Wed Oct 30 2012 Josh Boyer <jwboyer at redhat.com>
+- CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923)
+
* Mon Oct 29 2012 Justin M. Forbes <jforbes at redhat.com> 3.6.4-1
- Linux 3.6.4
diff --git a/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch b/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
new file mode 100644
index 0000000..109ee17
--- /dev/null
+++ b/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
@@ -0,0 +1,117 @@
+Path: news.gmane.org!not-for-mail
+From: Jesper Dangaard Brouer <brouer at redhat.com>
+Newsgroups: gmane.linux.network
+Subject: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois
+Date: Wed, 31 Oct 2012 13:45:32 +0100
+Lines: 63
+Approved: news at gmane.org
+Message-ID: <20121031124318.30915.32293.stgit at dragon>
+NNTP-Posting-Host: plane.gmane.org
+Mime-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+X-Trace: ger.gmane.org 1351687472 19921 80.91.229.3 (31 Oct 2012 12:44:32 GMT)
+X-Complaints-To: usenet at ger.gmane.org
+NNTP-Posting-Date: Wed, 31 Oct 2012 12:44:32 +0000 (UTC)
+Cc: Jesper Dangaard Brouer <brouer at redhat.com>, netdev at vger.kernel.org,
+ Petr Matousek <pmatouse at redhat.com>,
+ Stephen Hemminger <shemminger at vyatta.com>,
+ Eric Dumazet <eric.dumazet at gmail.com>
+To: "David S. Miller" <davem at davemloft.net>
+Original-X-From: netdev-owner at vger.kernel.org Wed Oct 31 13:44:40 2012
+Return-path: <netdev-owner at vger.kernel.org>
+Envelope-to: linux-netdev-2 at plane.gmane.org
+Original-Received: from vger.kernel.org ([209.132.180.67])
+ by plane.gmane.org with esmtp (Exim 4.69)
+ (envelope-from <netdev-owner at vger.kernel.org>)
+ id 1TTXex-0002V3-Qk
+ for linux-netdev-2 at plane.gmane.org; Wed, 31 Oct 2012 13:44:40 +0100
+Original-Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S932565Ab2JaMo0 (ORCPT <rfc822;linux-netdev-2 at m.gmane.org>);
+ Wed, 31 Oct 2012 08:44:26 -0400
+Original-Received: from mx1.redhat.com ([209.132.183.28]:57345 "EHLO mx1.redhat.com"
+ rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
+ id S1751941Ab2JaMoZ (ORCPT <rfc822;netdev at vger.kernel.org>);
+ Wed, 31 Oct 2012 08:44:25 -0400
+Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
+ by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9VCiOkC014655
+ (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
+ Wed, 31 Oct 2012 08:44:24 -0400
+Original-Received: from dragon.localdomain (ovpn-116-61.ams2.redhat.com [10.36.116.61])
+ by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9VCiMuW008440;
+ Wed, 31 Oct 2012 08:44:23 -0400
+Original-Received: from [127.0.0.1] (localhost [IPv6:::1])
+ by dragon.localdomain (Postfix) with ESMTP id 416D0E40666;
+ Wed, 31 Oct 2012 13:45:32 +0100 (CET)
+User-Agent: StGIT/0.14.3
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
+Original-Sender: netdev-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev at vger.kernel.org
+Xref: news.gmane.org gmane.linux.network:247871
+Archived-At: <http://permalink.gmane.org/gmane.linux.network/247871>
+
+Reading TCP stats when using TCP Illinois congestion control algorithm
+can cause a divide by zero kernel oops.
+
+The division by zero occur in tcp_illinois_info() at:
+ do_div(t, ca->cnt_rtt);
+where ca->cnt_rtt can become zero (when rtt_reset is called)
+
+Steps to Reproduce:
+ 1. Register tcp_illinois:
+ # sysctl -w net.ipv4.tcp_congestion_control=illinois
+ 2. Monitor internal TCP information via command "ss -i"
+ # watch -d ss -i
+ 3. Establish new TCP conn to machine
+
+Either it fails at the initial conn, or else it needs to wait
+for a loss or a reset.
+
+This is only related to reading stats. The function avg_delay() also
+performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
+calling point in update_params(). Thus, simply fix tcp_illinois_info().
+
+Function tcp_illinois_info() / get_info() is called without
+socket lock. Thus, eliminate any race condition on ca->cnt_rtt
+by using a local stack variable. Simply reuse info.tcpv_rttcnt,
+as its already set to ca->cnt_rtt.
+Function avg_delay() is not affected by this race condition, as
+its called with the socket lock.
+
+Cc: Petr Matousek <pmatouse at redhat.com>
+Signed-off-by: Jesper Dangaard Brouer <brouer at redhat.com>
+
+---
+V2:
+ Address Eric Dumazets input:
+ - Save 2 bytes of stack, by using info.tcpv_rttcnt.
+ - Help compiler, and define "u64 t" inside if() lexical scope.
+
+
+ net/ipv4/tcp_illinois.c | 8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
+index 813b43a..834857f 100644
+--- a/net/ipv4/tcp_illinois.c
++++ b/net/ipv4/tcp_illinois.c
+@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
+ .tcpv_rttcnt = ca->cnt_rtt,
+ .tcpv_minrtt = ca->base_rtt,
+ };
+- u64 t = ca->sum_rtt;
+
+- do_div(t, ca->cnt_rtt);
+- info.tcpv_rtt = t;
++ if (info.tcpv_rttcnt > 0) {
++ u64 t = ca->sum_rtt;
+
++ do_div(t, info.tcpv_rttcnt);
++ info.tcpv_rtt = t;
++ }
+ nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
+ }
+ }
+
More information about the scm-commits
mailing list